Manage GCP Dataproc Cluster IAM Permissions

The gcp:dataproc/clusterIAMBinding:ClusterIAMBinding resource, part of the Pulumi GCP provider, manages IAM role bindings for Dataproc clusters. This guide focuses on two capabilities: authoritative role assignment with ClusterIAMBinding and non-authoritative member addition with ClusterIAMMember.

These resources reference existing Dataproc clusters and use the provider’s default project and region unless explicitly specified. The examples are intentionally small. Combine them with your own cluster references and project configuration.

Grant a role to multiple members

Teams managing cluster access often need to assign a specific role to multiple users or service accounts, replacing any previous members for that role.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const editor = new gcp.dataproc.ClusterIAMBinding("editor", {
    cluster: "your-dataproc-cluster",
    role: "roles/editor",
    members: ["user:jane@example.com"],
});

import pulumi
import pulumi_gcp as gcp

editor = gcp.dataproc.ClusterIAMBinding("editor",
    cluster="your-dataproc-cluster",
    role="roles/editor",
    members=["user:jane@example.com"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dataproc"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := dataproc.NewClusterIAMBinding(ctx, "editor", &dataproc.ClusterIAMBindingArgs{
			Cluster: pulumi.String("your-dataproc-cluster"),
			Role:    pulumi.String("roles/editor"),
			Members: pulumi.StringArray{
				pulumi.String("user:jane@example.com"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var editor = new Gcp.Dataproc.ClusterIAMBinding("editor", new()
    {
        Cluster = "your-dataproc-cluster",
        Role = "roles/editor",
        Members = new[]
        {
            "user:jane@example.com",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.dataproc.ClusterIAMBinding;
import com.pulumi.gcp.dataproc.ClusterIAMBindingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var editor = new ClusterIAMBinding("editor", ClusterIAMBindingArgs.builder()
            .cluster("your-dataproc-cluster")
            .role("roles/editor")
            .members("user:jane@example.com")
            .build());

    }
}

resources:
  editor:
    type: gcp:dataproc:ClusterIAMBinding
    properties:
      cluster: your-dataproc-cluster
      role: roles/editor
      members:
        - user:jane@example.com

ClusterIAMBinding is authoritative for the specified role. When you update the members list, it replaces all existing members for that role on the cluster. The role property accepts predefined roles like “roles/editor” or custom roles in the format “projects/{project}/roles/{role-name}”. The members array accepts user emails, service account emails, groups, domains, or special identifiers like “allUsers”.

Add a single member to a role

When onboarding individual users or service accounts, you can add them to existing roles without affecting other members.

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

const editor = new gcp.dataproc.ClusterIAMMember("editor", {
    cluster: "your-dataproc-cluster",
    role: "roles/editor",
    member: "user:jane@example.com",
});

import pulumi
import pulumi_gcp as gcp

editor = gcp.dataproc.ClusterIAMMember("editor",
    cluster="your-dataproc-cluster",
    role="roles/editor",
    member="user:jane@example.com")

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/dataproc"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := dataproc.NewClusterIAMMember(ctx, "editor", &dataproc.ClusterIAMMemberArgs{
			Cluster: pulumi.String("your-dataproc-cluster"),
			Role:    pulumi.String("roles/editor"),
			Member:  pulumi.String("user:jane@example.com"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    var editor = new Gcp.Dataproc.ClusterIAMMember("editor", new()
    {
        Cluster = "your-dataproc-cluster",
        Role = "roles/editor",
        Member = "user:jane@example.com",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.dataproc.ClusterIAMMember;
import com.pulumi.gcp.dataproc.ClusterIAMMemberArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var editor = new ClusterIAMMember("editor", ClusterIAMMemberArgs.builder()
            .cluster("your-dataproc-cluster")
            .role("roles/editor")
            .member("user:jane@example.com")
            .build());

    }
}

resources:
  editor:
    type: gcp:dataproc:ClusterIAMMember
    properties:
      cluster: your-dataproc-cluster
      role: roles/editor
      member: user:jane@example.com

ClusterIAMMember is non-authoritative. It adds one member to a role without removing existing members. This resource is useful when multiple teams manage access independently, or when you want to grant access incrementally. You can use ClusterIAMMember alongside ClusterIAMBinding as long as they don’t manage the same role.

Beyond these examples

These snippets focus on specific IAM management features: role-based access control and authoritative vs non-authoritative member management. They’re intentionally minimal rather than full access control configurations.

The examples reference pre-existing infrastructure such as Dataproc clusters and GCP project and region configuration. They focus on configuring IAM bindings rather than provisioning clusters or projects.

To keep things focused, common IAM patterns are omitted, including:

Conditional IAM bindings (condition property)
Explicit project and region specification
Policy-level management (ClusterIAMPolicy)
Custom role definitions

These omissions are intentional: the goal is to illustrate how each IAM resource is wired, not provide drop-in access control modules. See the Dataproc ClusterIAMBinding resource reference for all available configuration options.

Let's manage GCP Dataproc Cluster IAM Permissions

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Resource Selection & Conflicts

Which IAM resource should I use for Dataproc cluster permissions?

You have three options:

ClusterIAMPolicy - Authoritative, replaces entire policy
ClusterIAMBinding - Authoritative per role, preserves other roles
ClusterIAMMember - Non-authoritative, adds single member while preserving others

Can I use ClusterIAMPolicy with ClusterIAMBinding or ClusterIAMMember?

No, ClusterIAMPolicy cannot be used alongside ClusterIAMBinding or ClusterIAMMember as they will conflict over policy control.

Can I use ClusterIAMBinding and ClusterIAMMember together?

Yes, but only if they grant different roles. Using both for the same role causes conflicts.

What happens if I accidentally remove cluster ownership with ClusterIAMPolicy?

ClusterIAMPolicy replaces the entire IAM policy, which can unset existing ownership permissions. Carefully review the complete policy before applying to avoid losing access.

Configuration & Syntax

How do I specify custom roles for Dataproc clusters?

Custom roles must use the format [projects|organizations]/{parent-name}/roles/{role-name}.

What member identity formats are supported?

Supported formats include:

allUsers - Anyone on the internet
allAuthenticatedUsers - Anyone with a Google account
user:{email} - Specific Google account
serviceAccount:{email} - Service account
group:{email} - Google group
domain:{domain} - G Suite domain

Immutability & Updates

What properties can't be changed after creating a ClusterIAMBinding?

The cluster, project, region, role, and condition properties are immutable and require resource replacement if changed.

Using a different cloud?

Explore iam guides for other cloud providers:

AWS Guides Azure Guides